New patches allow building Linux IPv6-only • Hacker News Board

Re: New patches allow building Linux IPv6-only

#61

Post by zadikian » Wed, Apr 01, 2026, 4:15 PM UTC

Sanzig wrote: post #37

everdrive wrote: post #12

Earlier quoted context omitted.

- I don't want my interfaces to have multiple IP addresses - I don't want my devices to have public, discoverable IPs - I like NAT and it works fine - I don't want to use dynamic DNS just so I have set up a single home server without my ISP rotating my /64 for no reason (and no SLAAC is not an answer because I don't want multiple addresses per interface) - I don't need an entire /48 for my home network IPv6 won't hel…

Why don't you want every device to have a public IP? There seems to be a perception that this is somehow insecure, but the default configuration of any router is to firewall everything. And one small bonus of the huge size of a /64 is that port scanning is not feasible, unlike in the old days when you could trivially scan a whole IPv4 /24 of a company that forgot to configure their firewall. NAT may work fine for you…

Many routers don't firewall by default. Lemme check later, but pretty sure my basic ASUS router doesn't either.

Re: New patches allow building Linux IPv6-only

#62

Post by lxgr » Wed, Apr 01, 2026, 4:19 PM UTC

LegionMammal978 wrote: post #39

lxgr wrote: post #26

Earlier quoted context omitted.

> nobody cares about NAT at home. Only because most people don't know how NAT is hurting them, and because corporations have spent incredible resources on hacking around the problem for when peer to peer is required (essentially only for VoIP latency optimization and gaming). NAT hurts peer to peer applications much more than cloud services, which are client-server by nature and as such indeed don't care that only ou…

Even in a NAT-less world, the common advice is to use a firewall rule that disallows incoming connections by default. (And I'd certainly be worried if typical home routers were configured otherwise.) So either way, you'd need the average person to mess with their router configuration, if they want to allow incoming P2P connections without hole-punching tricks. At best, the lack of NAT might save you an address-discov…

> the common advice is to use a firewall rule that disallows incoming connections by default.

That's good advice! But firewall hole punching is also significantly easier (and guaranteed to work) compared to NAT hole punching. Address discovery is part of it, but there are various ways to implement a NAT (some inherently un-hole-punch-able) and only really one sane way to do a firewall.

> you'd need the average person to mess with their router configuration,

At least with IPv6, that firewall is likely to exist in the CPE, which sophisticated users can then ideally open ports in (or which can implement UPnP/NAT-PMP or whatever the current name for the "open this port now!!" protocol of the decade is); for CG-NAT, it's often outright impossible.

Re: New patches allow building Linux IPv6-only

#63

Post by nurettin » Wed, Apr 01, 2026, 4:24 PM UTC

rafaelcosta wrote: post #3

As it should. Date notwithstanding, I would actually enjoy if there was a manually induced latency penalty for "legacy IP" that needs to be manually turned off on Linux. I know some people don't care at all, but the internet was made to be addressable. IPv6 is the only shot we have to go back to that.

> enjoy if there was a manually induced latency penalty for "legacy IP" that needs to be manually turned off on Linux

That sounds so bad, it probably will be a windows feature.

Re: New patches allow building Linux IPv6-only

#64

Post by ac29 » Wed, Apr 01, 2026, 4:29 PM UTC

iamnothere wrote: post #47

Sanzig wrote: post #37

Earlier quoted context omitted.

Why don't you want every device to have a public IP? There seems to be a perception that this is somehow insecure, but the default configuration of any router is to firewall everything. And one small bonus of the huge size of a /64 is that port scanning is not feasible, unlike in the old days when you could trivially scan a whole IPv4 /24 of a company that forgot to configure their firewall. NAT may work fine for you…

I don’t want some of my devices to be publicly addressable at all, even if I mess up something at the firewall while updating the rules. NAT provides this by default. I don’t want a static address either (although static addresses should be freely available to those who want them). Having a rotating IP provides a small privacy benefit. People who have upset other people during an online gaming session will understand…

> I don’t want some of my devices to be publicly addressable at all, even if I mess up something at the firewall while updating the rules. NAT provides this by default.

This feels like a strawman. If you are making the sort of change that accidentally disables your IPv6 firewall completely, you could accidentally make a change that exposed IPv4 devices as well (accidentally enabling DMZ, or setting up port forwarding incorrectly for example).

Re: New patches allow building Linux IPv6-only

#65

Post by UltraSane » Wed, Apr 01, 2026, 4:33 PM UTC

everdrive wrote: post #12

rafaelcosta wrote: post #3

As it should. Date notwithstanding, I would actually enjoy if there was a manually induced latency penalty for "legacy IP" that needs to be manually turned off on Linux. I know some people don't care at all, but the internet was made to be addressable. IPv6 is the only shot we have to go back to that.

- I don't want my interfaces to have multiple IP addresses - I don't want my devices to have public, discoverable IPs - I like NAT and it works fine - I don't want to use dynamic DNS just so I have set up a single home server without my ISP rotating my /64 for no reason (and no SLAAC is not an answer because I don't want multiple addresses per interface) - I don't need an entire /48 for my home network IPv6 won't hel…

NAT is a horrible, HORRIBLE hack that makes everything in networking much more complicated. IP networking is very elegant when everyone is using globally unique addresses and a ugly mess when Carrier NAT is used.

Re: New patches allow building Linux IPv6-only

#66

Post by iamnothere » Wed, Apr 01, 2026, 4:34 PM UTC

ac29 wrote: post #64

iamnothere wrote: post #47

Earlier quoted context omitted.

I don’t want some of my devices to be publicly addressable at all, even if I mess up something at the firewall while updating the rules. NAT provides this by default. I don’t want a static address either (although static addresses should be freely available to those who want them). Having a rotating IP provides a small privacy benefit. People who have upset other people during an online gaming session will understand…

> I don’t want some of my devices to be publicly addressable at all, even if I mess up something at the firewall while updating the rules. NAT provides this by default. This feels like a strawman. If you are making the sort of change that accidentally disables your IPv6 firewall completely, you could accidentally make a change that exposed IPv4 devices as well (accidentally enabling DMZ, or setting up port forwarding…

As someone who has done this while tired, it’s a lot easier to accidentally open extra ports to a publicly routable IP (or overbroad range of IPs) than it is to accidentally enable port forwarding or DMZ.

Re: New patches allow building Linux IPv6-only

#67

Post by UltraSane » Wed, Apr 01, 2026, 4:35 PM UTC

iamnothere wrote: post #47

Sanzig wrote: post #37

Earlier quoted context omitted.

Why don't you want every device to have a public IP? There seems to be a perception that this is somehow insecure, but the default configuration of any router is to firewall everything. And one small bonus of the huge size of a /64 is that port scanning is not feasible, unlike in the old days when you could trivially scan a whole IPv4 /24 of a company that forgot to configure their firewall. NAT may work fine for you…

I don’t want some of my devices to be publicly addressable at all, even if I mess up something at the firewall while updating the rules. NAT provides this by default. I don’t want a static address either (although static addresses should be freely available to those who want them). Having a rotating IP provides a small privacy benefit. People who have upset other people during an online gaming session will understand…

You can have IPv6 firewalls emulate the behavior of NAT so it blocks unsolicited inbound traffic while allowing outbound traffic. If you get a /48 form your ISP you could rotate to a new IP address every second for the rest of your life.

Re: New patches allow building Linux IPv6-only

#68

Post by UltraSane » Wed, Apr 01, 2026, 4:37 PM UTC

t0mas88 wrote: post #22

everdrive wrote: post #12

Earlier quoted context omitted.

- I don't want my interfaces to have multiple IP addresses - I don't want my devices to have public, discoverable IPs - I like NAT and it works fine - I don't want to use dynamic DNS just so I have set up a single home server without my ISP rotating my /64 for no reason (and no SLAAC is not an answer because I don't want multiple addresses per interface) - I don't need an entire /48 for my home network IPv6 won't hel…

IPv4 is not holding back home setups, nobody cares about NAT at home. The place where it hurts is small VPSs, from AWS to mom and pop hosters, the cost of addresses is becoming significant compared to low cost VPSs.

NAT is hurting anyone who has to use CGNAT and share an IP with a bunch of other people.

Re: New patches allow building Linux IPv6-only

#69

Post by iamnothere » Wed, Apr 01, 2026, 4:38 PM UTC

UltraSane wrote: post #67

iamnothere wrote: post #47

Earlier quoted context omitted.

I don’t want some of my devices to be publicly addressable at all, even if I mess up something at the firewall while updating the rules. NAT provides this by default. I don’t want a static address either (although static addresses should be freely available to those who want them). Having a rotating IP provides a small privacy benefit. People who have upset other people during an online gaming session will understand…

You can have IPv6 firewalls emulate the behavior of NAT so it blocks unsolicited inbound traffic while allowing outbound traffic. If you get a /48 form your ISP you could rotate to a new IP address every second for the rest of your life.

Right, but if you’re messing around as a naive learner it’s easy to accidentally disable that or completely open up an IP or range due to a bad rule. It’s a lot harder to accidentally enable port forwarding on a NAT.

Re: New patches allow building Linux IPv6-only

#70

Post by craftkiller » Wed, Apr 01, 2026, 4:40 PM UTC

jrm4 wrote: post #54

Sanzig wrote: post #37

Earlier quoted context omitted.

Why don't you want every device to have a public IP? There seems to be a perception that this is somehow insecure, but the default configuration of any router is to firewall everything. And one small bonus of the huge size of a /64 is that port scanning is not feasible, unlike in the old days when you could trivially scan a whole IPv4 /24 of a company that forgot to configure their firewall. NAT may work fine for you…

[flagged]

You can't correlate the number of addresses with the number of devices because IPv6 temporary addresses exist. If you enable temporary addresses, your computer will periodically randomly generate a new address and switch to it.

https://www.rfc-editor.org/rfc/rfc8981.html